6 ms·

One thing that I was surprised not to see in the post was how to deal with editing files that have secrets (such as API keys or email credentials). When I set

by nickjj 6y ago

One thing that I was surprised not to see in the post was how to deal with editing files that have secrets (such as API keys or email credentials). When I set up OBS, I overlayed a full screen image that says I'm showing something secret which had nothing but a small webcam feed in the bottom right so folks could still see me but not my desktop. It was assigned to a global hotkey toggle of course.

Kuinox 6y ago
Personally, I would stream on a VM to avoid secret leak. PR you own projects, never put any secret on this VM.
VikingCoder 6y ago
I think the best way to deal with secrets is to not live stream them, at all, ever, in any way. If you have secrets anywhere near your live stream, it's not a question if "if" you will leak them but "when." Don't put yourself in that situation. Work _hard_ to keep yourself out of that situation.
- nickjj 6y ago
  It's not always possible to do this. Let's say I live streamed implementing Stripe. There's no way to avoid not showing my test API keys if I'm going to show the end to end process of setting everything up. The best I could do is to roll the keys before I start the stream but this degrades the quality of the stream since it's not from scratch. Of course those keys and anything else that's sensitive would be sitting in an .env file, and I'd also have an .env.example file showing how it's set up without anything sensitive being in there (I do this already in my pre-recorded videos). Even going as far as preventing the real .env file coming up when I fuzzy open files so I don't open it by accident and the contents of that file being ignored from multi-file searches.
  - mcny 6y ago
    Maybe the answer is simpler than that. Rotating a key should never be painful. If you accidentally reveal a key, it should be straightforward to change it (I'm sure your audience will understand if you take a one minute break).
    - nickjj 6y ago
      The reveal wouldn't be by accident typically. It could be a necessary requirement based on the content you're streaming. If you revealed a Stripe key only to change it 1 minute afterwards, you still need a process to change it in secret, which goes back to my original reply of setting up a dedicated "secret" scene so you can modify things in private.
      - evv 6y ago
        You can switch to a different scene when handling sensitive details, like the camera feed or the "technical difficulties" scene. This is how I've seen folks deal with secrets in the past
  - VikingCoder 6y ago
    I'm sorry, but you claimed "it's not always possible to do this," and then your example started "Let's say I live streamed." You are making the choice to live stream. It is always possible to avoid live streaming. Always.
- corobo 6y ago
  That would require no secrets. All it takes is a misclick into a .env file. I’d assume you’re not coding on a production system so your secrets shouldn’t be too hard to revoke, cycle them after your stream and any time you leak them.
  - evan_ 6y ago
    Put a couple hundred line breaks at the top of your .env file so if you open it it’s just white space
  - xxpor 6y ago
    Secrets should really be stored in services, not files outside of maybe a single bootstrap file (unless you're working on the secret storage service itself). I generate my secrets once, send them off to the secrets service, and then my service queries that service. I never see the secrets with my own eyes.
    - tnorthcutt 6y ago
      Can you expand on this? What service do you use to store your secrets?
    - dividedbyzero 6y ago
      What are you using for this? This sounds like a neat setup.
    - corobo 6y ago
      It is a single bootstrap file, it bootstraps your env variables I've not come across what you describe
    - this-pony 6y ago
      This sounds like a turtles all the way down kind of think... Then is it OK to keep the secret of the secrets service, or something in that sense.
      - dfee 6y ago
29athrowaway 6y ago
On Twitch: - Not only I have seen secrets revealed on stream, like passwords and tokens and such... I have seen people working with databases full of personally identifiable information, and you could see names, phone numbers, e-mails and addresses on stream. There are irresponsible people out here. - I have seen people doxxing themselves by showing their git identity, or some popup window with some licensing information such as "Registered to: John Doe", or when the autocomplete suggestions on their browser search bar shows "[Facebook favicon] John Doe". As you can see, there are many, many ways to leak your identity on stream. If you want to have a discrete online presence, try to do all your work on a dedicated VM, or take measures such as using a dedicated browser for your stream related activities, a separate git identity, hide splash screens, and pay attention to detail at how things look before you go live.
- pjc50 6y ago
  .. why would you live stream yourself if you weren't willing to expose your real identity?
  - 29athrowaway 6y ago
    Note that many streamers do not use a webcam, or don't show their faces on camera. Some do use a camera but still conceal their basic personal information. There are benefits to streaming. It somehow makes you productive, because you don't want to look bad in front of your audience. Plus, there are smart people on Twitch. A lot of lurkers that do not stream have an impressive amount of knowledge. Money-wise, it's not worth it. The category that has the most programmers, "Science & Technology", has only 2,000 viewers at a time on a good day. That is very little compared to other categories. If you want to make money, publishing YouTube videos may be way more profitable than Twitch.
    - fpgaminer 6y ago
      > Some do use a camera but still conceal their basic personal information. That's really the critical bit. It's one thing to show your face on camera. It's another to show your name and address. The latter bits are regularly used to, e.g., SWAT streamers. Let's just say that streamers are all too familiar with legal trusts.
WorldMaker 6y ago
There is a mention of it, but it isn't clearly marked that this is in part specifically why: the article author takes a dual monitor approach and presumably restricts all secrets to the monitor that is never involved in any of the scenes (the main laptop monitor in this case). Though with keyboard camera they probably should be more careful in which scenes show that if any of those secrets are typed rather than say copy/pasted.
jdoliner 6y ago
This reminds me of a very funny moment I saw where a streamer was opening his beta invite key for a new game live and realized when he did that he had just leaked the key and someone was going to steal his invite, but he had a 10 second stream delay setup which give him just enough time to rush and enter the key before anyone else could use it.
- unnouinceput 6y ago
  Twitch has like 30 seconds delay, giving you plenty of time for this kind of moments. If you need more then 30 seconds, then you're out of luck and shouldn't be on Twitch in the first place.
  - drchickensalad 6y ago
    That's not true at all in 2020. Most streamers have low latency on which reduces it to ~3 seconds or less.
    - unnouinceput 6y ago
      And I would not recommend stay in low latency feature of Twitch. You are there to show people something, not to live chat with them. Opt-out of it and comeback to normal 30 seconds delay. Reasons to do this includes, but not limited to: -1 -if gaming on a FPS, enemies might use your Twitch stream to find you. 30 seconds delay allows you to actually use counter-measures and employ disinformation tactics on your stream -2 -if showing something, chat should be secondary, not primary. You're not on a live AMA, for that use Youtube LIVE (or chaturbate if that's your thing, I don't judge) -3 -as said above, to give you time to react to your own mistakes -4 -post processing for additional effects/reasons. Making a loop allows you to cut into mid-stream in some cases. This is an advanced use though, I only know of one twitcher that uses this
      - andrewzah 6y ago
        "You are there to show people something, not to live chat with them" Many, many streamers expressly DO want to live chat with viewers. As a viewer, I don't like streamers that don't interact with chat. I may as well as watch a youtube video at that point. As a streamer, the entire point for me is to interact with people. If all I wanted to do was showcase something, I'd make youtube videos... There are other methods one can use to avoid i.e. stream sniping besides having a long latency. "You're not on a live AMA" Twitch literally has a "Just Chatting" category. That said, there's nothing wrong with a streamer taking a break from the game to just chat for a bit. If you don't like that, instead of telling people how they should act, why not find a different streamer or use a different platform?

by nickjj 6y ago

Kuinox 6y ago

Personally, I would stream on a VM to avoid secret leak. PR you own projects, never put any secret on this VM.

VikingCoder 6y ago

I think the best way to deal with secrets is to not live stream them, at all, ever, in any way. If you have secrets anywhere near your live stream, it's not a question if "if" you will leak them but "when." Don't put yourself in that situation. Work _hard_ to keep yourself out of that situation.

nickjj 6y ago
It's not always possible to do this. Let's say I live streamed implementing Stripe. There's no way to avoid not showing my test API keys if I'm going to show the end to end process of setting everything up. The best I could do is to roll the keys before I start the stream but this degrades the quality of the stream since it's not from scratch. Of course those keys and anything else that's sensitive would be sitting in an .env file, and I'd also have an .env.example file showing how it's set up without anything sensitive being in there (I do this already in my pre-recorded videos). Even going as far as preventing the real .env file coming up when I fuzzy open files so I don't open it by accident and the contents of that file being ignored from multi-file searches.
- mcny 6y ago
  Maybe the answer is simpler than that. Rotating a key should never be painful. If you accidentally reveal a key, it should be straightforward to change it (I'm sure your audience will understand if you take a one minute break).
  - nickjj 6y ago
    The reveal wouldn't be by accident typically. It could be a necessary requirement based on the content you're streaming. If you revealed a Stripe key only to change it 1 minute afterwards, you still need a process to change it in secret, which goes back to my original reply of setting up a dedicated "secret" scene so you can modify things in private.
    - evv 6y ago
      You can switch to a different scene when handling sensitive details, like the camera feed or the "technical difficulties" scene. This is how I've seen folks deal with secrets in the past
- VikingCoder 6y ago
  I'm sorry, but you claimed "it's not always possible to do this," and then your example started "Let's say I live streamed." You are making the choice to live stream. It is always possible to avoid live streaming. Always.
corobo 6y ago
That would require no secrets. All it takes is a misclick into a .env file. I’d assume you’re not coding on a production system so your secrets shouldn’t be too hard to revoke, cycle them after your stream and any time you leak them.
- evan_ 6y ago
  Put a couple hundred line breaks at the top of your .env file so if you open it it’s just white space
- xxpor 6y ago
  Secrets should really be stored in services, not files outside of maybe a single bootstrap file (unless you're working on the secret storage service itself). I generate my secrets once, send them off to the secrets service, and then my service queries that service. I never see the secrets with my own eyes.
  - tnorthcutt 6y ago
    Can you expand on this? What service do you use to store your secrets?
  - dividedbyzero 6y ago
    What are you using for this? This sounds like a neat setup.
  - corobo 6y ago
    It is a single bootstrap file, it bootstraps your env variables I've not come across what you describe
  - this-pony 6y ago
    This sounds like a turtles all the way down kind of think... Then is it OK to keep the secret of the secrets service, or something in that sense.
    - dfee 6y ago

29athrowaway 6y ago

On Twitch: - Not only I have seen secrets revealed on stream, like passwords and tokens and such... I have seen people working with databases full of personally identifiable information, and you could see names, phone numbers, e-mails and addresses on stream. There are irresponsible people out here. - I have seen people doxxing themselves by showing their git identity, or some popup window with some licensing information such as "Registered to: John Doe", or when the autocomplete suggestions on their browser search bar shows "[Facebook favicon] John Doe". As you can see, there are many, many ways to leak your identity on stream. If you want to have a discrete online presence, try to do all your work on a dedicated VM, or take measures such as using a dedicated browser for your stream related activities, a separate git identity, hide splash screens, and pay attention to detail at how things look before you go live.

pjc50 6y ago
.. why would you live stream yourself if you weren't willing to expose your real identity?
- 29athrowaway 6y ago
  Note that many streamers do not use a webcam, or don't show their faces on camera. Some do use a camera but still conceal their basic personal information. There are benefits to streaming. It somehow makes you productive, because you don't want to look bad in front of your audience. Plus, there are smart people on Twitch. A lot of lurkers that do not stream have an impressive amount of knowledge. Money-wise, it's not worth it. The category that has the most programmers, "Science & Technology", has only 2,000 viewers at a time on a good day. That is very little compared to other categories. If you want to make money, publishing YouTube videos may be way more profitable than Twitch.
  - fpgaminer 6y ago
    > Some do use a camera but still conceal their basic personal information. That's really the critical bit. It's one thing to show your face on camera. It's another to show your name and address. The latter bits are regularly used to, e.g., SWAT streamers. Let's just say that streamers are all too familiar with legal trusts.

WorldMaker 6y ago

There is a mention of it, but it isn't clearly marked that this is in part specifically why: the article author takes a dual monitor approach and presumably restricts all secrets to the monitor that is never involved in any of the scenes (the main laptop monitor in this case). Though with keyboard camera they probably should be more careful in which scenes show that if any of those secrets are typed rather than say copy/pasted.

jdoliner 6y ago

This reminds me of a very funny moment I saw where a streamer was opening his beta invite key for a new game live and realized when he did that he had just leaked the key and someone was going to steal his invite, but he had a 10 second stream delay setup which give him just enough time to rush and enter the key before anyone else could use it.

unnouinceput 6y ago
Twitch has like 30 seconds delay, giving you plenty of time for this kind of moments. If you need more then 30 seconds, then you're out of luck and shouldn't be on Twitch in the first place.
- drchickensalad 6y ago
  That's not true at all in 2020. Most streamers have low latency on which reduces it to ~3 seconds or less.
  - unnouinceput 6y ago
    And I would not recommend stay in low latency feature of Twitch. You are there to show people something, not to live chat with them. Opt-out of it and comeback to normal 30 seconds delay. Reasons to do this includes, but not limited to: -1 -if gaming on a FPS, enemies might use your Twitch stream to find you. 30 seconds delay allows you to actually use counter-measures and employ disinformation tactics on your stream -2 -if showing something, chat should be secondary, not primary. You're not on a live AMA, for that use Youtube LIVE (or chaturbate if that's your thing, I don't judge) -3 -as said above, to give you time to react to your own mistakes -4 -post processing for additional effects/reasons. Making a loop allows you to cut into mid-stream in some cases. This is an advanced use though, I only know of one twitcher that uses this
    - andrewzah 6y ago
      "You are there to show people something, not to live chat with them" Many, many streamers expressly DO want to live chat with viewers. As a viewer, I don't like streamers that don't interact with chat. I may as well as watch a youtube video at that point. As a streamer, the entire point for me is to interact with people. If all I wanted to do was showcase something, I'd make youtube videos... There are other methods one can use to avoid i.e. stream sniping besides having a long latency. "You're not on a live AMA" Twitch literally has a "Just Chatting" category. That said, there's nothing wrong with a streamer taking a break from the game to just chat for a bit. If you don't like that, instead of telling people how they should act, why not find a different streamer or use a different platform?